Apparatus and method for detecting network failure location

ABSTRACT

A L2 loop failure location generated in any one of a plurality of search target apparatuses disposed in network is detected in a short time. A network failure location detecting apparatus executes the steps of broadcasting packets with a plurality of different source MAC addresses; acquiring statistical information that is information of a learning port of the plurality of different source MAC addresses learned by each of the plurality of search target apparatuses; finding whether the number of the learning ports of the plurality of different source MAC addresses is one or two from the acquired statistical information; and determining that the L2 loop failure location is the search target apparatus including two learning ports of the plurality of different source MAC addresses.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of priority fromthe prior Japanese Patent Application No. 2005-367936, filed on Dec. 21,2005, the entire contents of which are incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates generally to a network failure locationdetecting apparatus and a network failure location detecting method thatdetect a failure occurring on a network, and, more particularly, to anetwork failure location detecting apparatus and a network failurelocation detecting method that detect a layer 2 loop, which is a failureoccurring in a relay apparatus constituting the network.

2. Description of the Related Art

A relay apparatus called a layer 2 (L2) switch constituting network suchas LAN is one of a relay apparatus of a network and has a function fordetermining a destination of a packet with data of a data link layer(second layer) in an OSI reference model to transfer the packet.

Protocols of the data link layer include MAC (media access control) inthe Ethernet (registered trademark), etc. and a relay apparatus of theEthernet (registered trademark) is also referred to as a switching hub,which refers to a MAC address to determine a destination of data.

Since protocols such as IP, TCP, and HTTP are located on a network layer(third layer) or later, the layer 2 switch can transfer a packet if theprotocol of the third layer or later is different.

In a network where a plurality of terminals is connected by the layer 2switch, a failure called a layer 2 loop is generated in entire networkby improper connection of cables or a failure of the layer 2 switch. Thegeneration of the layer 2 loop causes a heavy load situation ofterminals in entire network and makes the network communicationimpossible.

FIGS. 1 to 3 are diagrams for describing the network failure due to thelayer 2 loop. In FIG. 1, a network is configured by connecting a layer 2switch (hereinafter, “switch”) SW1 with subsequent switches SW2, SW3,and SW4, by connecting the switches SW2, SW3, and SW4 with subsequentswitches SW5, SW6, and SW7, respectively, and by connecting the switchesSW5, SW6, and SW7 with terminals Y1, Y2, and X, respectively.

It is assumed that the switch SW2 is connected in loop due to impropercable connection in the switch SW2 to generate a layer 2 loop.

Description will be made of the case that the terminal X transmits abroadcast packet. When the terminal X transmits the broadcast packet,the broadcast packet arrives at the switch SW2 generating the L2 loopvia the switches SW7, SW4, and SW1.

The broadcast packet is sent out to the entire network (subnet) from theswitch SW2 every time the packet goes around the loop. Since the loopcirculation is performed at a wirespeed, the broadcast packet iscontinuously sent out from the switch SW2 at the wire speed to theentire network (which is called a broadcast storm), and the terminals inthe network fall into a heavy load situation.

When the broadcast packet is input into one of a plurality of ports ofeach switch, the switch stores aMAC address of a source terminalincluded in the broadcast packet and recognizes that the direction ofthe transmission terminal of the broadcast packet is the direction ofthe input port (hereinafter, this may be represented to as “learning anaddress”).

Therefore, due to the broadcast storm, some switches learn the addressof the transmission terminal erroneously. That is, each switchrecognizes that the source address of the broadcast packet is located inthe direction of the L2 loop occurrence location (switch SW2).Therefore, erroneous learning of the source terminal address happens ineach switch on the path between the terminal X and the L2 loopoccurrence location.

Specifically, since the terminal X learns the address as if a virtualimage of the terminal X transmitting the broadcast packet exists at theswitch SW2 where the L2 loop occurs, the address of the terminal X islearned erroneously by the switches SW7, SW4, SW1, and SW2 located onthe path between the terminal X and the L2 loop occurrence location inFIG. 1.

In this way, if a terminal transmits a broadcast packet when the L2 loopoccurs, the address of the terminal is learned erroneously by switcheson the path from the terminal X to the location where the L2 loopoccurs.

The switches SW3, SW5, and SW6 do not learn erroneously merely becausethe packet reception directions are the same when the packet istransmitted from the actual terminal X and when the packet istransmitted from the L2 loop occurrence location.

If the L2 loop occurs and causes a network failure as described above,this must be searched and restored. In a method of performing suchsearch, conventionally, if the L2 loop occurs, the L2 loop occurrencelocation has been narrowed down by manually taking out and putting inthe cables of the layer 2 switch or by repeating a procedure foracquiring information about a connection status from a suspected switch.Therefore, a great deal of time (several hours to several days) andeffort was needed until the L2 loop occurrence location was discovered.

For example, Japanese Patent Application Laid-Open Publication No.2001-197114 is known as a technology for detecting occurrence of thelayer 2 loop that causes a network failure. The technology described inJapanese Patent Application Laid-Open Publication No. 2001-197114 is amethod of determining an endless loop of a frame from analysis of areception frame to detect the L2 loop.

Japanese Patent Application Laid-Open Publication No. 2005-33360discloses an invention of detecting a loop in a network extended withthe use of a bridge. In this invention, an address learning table isprovided in the bridge and a loop is detected from a transition state ofan entry port to the address learning table.

However, according to the Japanese Patent Application Laid-OpenPublication No. 2001-197114, while it can be detected that the L2 loopoccurs somewhere in the network (subnet), the location of the occurrenceof the L2 loop cannot be identified in the subnet. According to JapanesePatent Application Laid-Open Publication No. 2005-33360, the applicationis limited to the particular form, that is, the application to thenetwork extended with the use of a bridge.

Therefore, in the earlier application (Patent Application No.2005-179294), the applicant filed an invention relating to a networkfailure detecting apparatus and a network failure detecting method thatcan detect the occurrence of the L2 loop and the occurrence locationthereof quickly and easily.

The invention shown in the aforementioned earlier application (PatentApplication No. 2005-179294) of the applicant is a network failuredetecting apparatus that is a first terminal of a plurality ofterminals; each terminal detects a failure in a network constituted byconnecting other terminals via at least one relay apparatus of aplurality of relay apparatuses; and the network failure detectingapparatus includes a communicating unit that acquires statisticalinformation from a first relay apparatus of the plurality of relayapparatuses relating to data received by each of a plurality of ports ofthe first relay apparatus and a determining unit that determines basedon the statistical information whether or not a loop causing apredetermined network failure is generated in the first relay apparatusor determines the direction from the first relay apparatus to anotherrelay apparatus where the loop is generated.

That is, reception traffic information is acquired from a relayapparatus (switch, etc.) in a network where the L2 loop is generated;the number of ports receiving a massive amount of packets is determined;and it is determined whether or not a loop is created at the relayapparatus or which port direction of the relay apparatus the loop iscreated.

The invention of the earlier application can identify the L2 loopoccurrence location. However, since the reception traffic informationmust be acquired a plurality of times from IFs of the relay apparatus toidentify the loop location, it is problematic that a long time is neededto search a relay apparatus with many IFs. In some types of the relayapparatus, if a loop is created, the loop may be intermittentlydiscontinued due to the influence of flow control, etc. Under such asituation, it is problematic that the loop location cannot be identifiedsince less traffic exists in the loop direction.

SUMMARY OF THE INVENTION

It is therefore the object of the present invention to enable theidentification of the location in a short time without dependency on thenumber of IFs of the relay apparatus and to enable the identification ifthe loop is intermittently discontinued.

In order to achieve the above object, according to an aspect of thepresent invention there is provided a method of searching for a L2 loopfailure location generated in any one of a plurality of search targetapparatuses disposed in a network with a network failure locationdetecting apparatus, wherein the network failure location detectingapparatus executes the steps of broadcasting packets with a plurality ofdifferent source MAC addresses; acquiring statistical information thatis information of a learning port of the plurality of different sourceMAC addresses learned by each of the plurality of search targetapparatuses; finding whether the number of the learning ports of theplurality of different source MAC addresses is one or two from theacquired statistical information; and determining that the L2 loopfailure location is the search target apparatus including two learningports of the plurality of different source MAC addresses. The networkfailure location detecting apparatus may send an acquisition requestcommand in the Simple Network Management Protocol that is a MIB(Management Information Base) acquisition request to a plurality of thesearch target apparatuses disposed in the network preliminarily beforebroadcasting the packets with the plurality of different source MACaddresses, receive response packets from the search target apparatusescapable of responding, and acquire addresses of the search targetapparatuses from the received response packets. When the search targetapparatus includes only one learning port of the plurality of source MACaddresses, it may be determined that a network failure location existsin the direction of the learning port. The network failure locationdetecting apparatus may send to the search target apparatus includingtwo learning ports of the plurality of source MAC addresses that isdetermined as the L2 loop failure location a message for blocking aninterface of one of the two learning ports to bypass the L2 loopfailure.

In order to achieve the above object, according to another aspect of thepresent invention there is provided a network failure location detectingapparatus that detects a L2 loop failure location generated in any oneof a plurality of switches disposed in a network, the network failurelocation detecting apparatus comprising a statistical informationacquiring unit that broadcasts packets with a plurality of differentsource MAC addresses, the statistical information acquiring unitacquiring statistical information that is information of a learning portof the plurality of different source MAC addresses learned by each ofthe plurality of search target apparatuses; and a data analyzing unitthat finds whether the number of the learning ports of the plurality ofdifferent source MAC addresses is one or two from the statisticalinformation acquired by the statistical information acquiring unit, thedata analyzing unit determining that the L2 loop failure location is thesearch target apparatus including two learning ports of the plurality ofdifferent source MAC addresses. The statistical information acquiringunit may send an acquisition request command in the Simple NetworkManagement Protocol that is a MIB (Management Information Base)acquisition request to a plurality of the search target apparatusesdisposed in the network preliminarily before broadcasting the packetswith the plurality of different source MAC addresses, and the dataanalyzing unit may receive response packets from the search targetapparatuses capable of responding and acquire addresses of the searchtarget apparatuses from the received response packets. When the searchtarget apparatus includes only one learning port of the plurality ofsource MAC addresses, the data analyzing unit may determine that anetwork failure location exists in the direction of the learning port.The statistical information acquiring unit may send to the search targetapparatus including two learning ports of the plurality of source MACaddresses that is determined as the L2 loop failure location a messagefor blocking an interface of one of the two learning ports to bypass theL2 loop failure. The network failure location detecting apparatus may beconstituted by a terminal connected to any one of a plurality of theswitches disposed in the network.

According to the present invention, the occurrence of the loop causing afailure in a network and the occurrence location thereof can be detectedin a short time. Particularly, if the loop packet is intermittentlydiscontinued, the occurrence location can be detected.

The loop can be detected by the process of the terminal constituting thenetwork and the loop can be detected without the process of the relayapparatus constituting the network. That is, while a relatively greatdeal of effort and time is needed for implementing a new function in therelay apparatus, since the present invention does not need suchimplementing and is the process executed by the terminal to which a newfunction can be added merely by installing an application program, thepresent invention can be realized in an easy, simple, and versatilemanner by installing and executing an application program for executingthe process of the present invention in the terminal.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other objects, aspects, features and advantages of thepresent invention will become more apparent from the following detaileddescription when taken in conjunction with the accompanying drawings, inwhich:

FIG. 1 is a diagram for describing a network failure due to a layer 2loop;

FIG. 2 is a diagram for describing a network failure due to a layer 2loop;

FIG. 3 is a diagram for describing a network failure due to a layer 2loop;

FIG. 4 shows a configuration example of a network failure locationdetecting system according to the principle of the present invention;

FIG. 5 is a process flow shown in FIG. 5 corresponding to FIG. 4;

FIG. 6 shows a procedure of detecting the L2 loop location in a networkshown as an embodiment;

A process flowchart of a network failure detecting apparatus in a firstembodiment of the present invention;

FIG. 7 is an operation flow corresponding to FIG. 6;

FIG. 8 is a sequence chart corresponding to an example of broadcastingdifferent source MAC addresses (A, B, C, D, and E);

FIG. 9 is a sequence chart that solves a problem in the method ofbroadcasting the packets with different source MAC addresses describedin FIG. 8;

FIG. 10 is a flow of a method of a bypass process for the L2 loopfailure occurrence location;

FIG. 11 is a process flowchart for obtaining addresses of search targetswitches;

FIG. 12 shows a flow of a process considering characteristics of thevendor of the search target switch;

FIG. 13 shows an example of the table that shows a relationship betweenthe first three bytes (OUI) of the MAC addresses obtained and stored inadvance and the vendors;

FIG. 14 shows a table that correlates the extracted apparatus vendorswith the search target apparatuses (switches) and the MAC addressesthereof; and

FIG. 15 is a flow that shows a procedure of detecting a location linkedto the communication restoring means corresponding to the vendor.

DESCRIPTION OF THE PREFERRED EMBODIMENTS

Description will be made of embodiments of the present invention withreference to the drawings. It is to be noted that such embodiments arefor the purpose of understanding the present invention and that they arenot intended to limit the technical scope of the present invention.

First, with regard to the overview of the present invention, if an L2loop, i.e., a network failure occurs, a broadcast packet sent out withinthe same subnet arrives at a relay apparatus (switch) constituting theL2 loop and is sent out to the whole area of the same subnet every timethe packet goes around the loop. Each relay apparatus receives thebroadcast packet from the direction of the location where the loopexists and learns the source MAC address of the broadcast packet in thesame port direction.

Focusing attention on the learning of the source MAC address in therelay apparatus, when the L2 loop occurs, the relay apparatusconstituting the loop learns the source MAC address of the broadcastpacket at one port in one direction. Particularly, the relay apparatusconstituting the loop has clockwise and anticlockwise rotations of theloop. Therefore, the source MAC address of the broadcast packet islearned in either of two port directions.

FIG. 4 shows a configuration example of a network failure locationdetecting system according to the principle of the present invention inconsideration of such situations. In FIG. 4, a network is constituted byconnecting a layer 2 switch SW1 with subsequent switches SW2, SW3, andSW4 and by connecting the switches SW2, SW3, and SW4 with terminals 10,20, and 30.

The solution principle of the present invention is applied to an L2 loopfailure (network failure) location detecting apparatus 1, which may bean apparatus that is incorporated into the network by connectingsuitably to act as one terminal. In one requirement, a statisticalinformation acquiring unit 11 and a data analyzing unit 12 are included,which are a function that can collect statistical information includinginformation of the MAC address learning direction described above from aplurality of relay apparatuses (switches) connected to the network.

In the example shown in FIG. 4, the L2 loop is generated at a port 1 anda port 3 of the switch 2; the broadcast packets are continuously sentout at wire speed due to the L2 loop; in the switch SW2, the port 1 andthe port 3 constituting the L2 loop are a massive reception port; and inthe switches SW1, SW3, and SW4, respective ports 1 in the direction ofthe switch SW2 are massive reception ports. That is, in the switchesSW1, SW3, and SW4, the source address of the broadcast packet is learnedin one port direction and, in the switch SW2, the source address of thebroadcast packet is learned in either of two port directions.

In a process flow shown in FIG. 5 corresponding to FIG. 4, thestatistical information acquiring unit 11 of the network failurelocation detecting apparatus 1 acquires the information of the MACaddress learning direction for each of the switches SW1, SW2, SW3, andSW4, which are relay apparatuses (step S01).

The statistical information acquired by the statistical informationacquiring unit 11 is analyzed by the data analyzing unit 12 to detectthe L2 loop location. In the detection of the L2 loop location, a switchwith two learning ports for a plurality of different source MACaddresses is detected, and it is determined that the L2 loop failureoccurs at this switch.

Description will be made of a specific embodiment corresponding to theprinciple configuration shown in FIGS. 4 and 5.

FIG. 6 shows a procedure of detecting the L2 loop location in a networkshown as an embodiment and FIG. 7 is an operation flow corresponding toFIG. 6.

In FIG. 6, the network includes switches SW1, SW2, and SW3, and it isassumed that the L2 loop failure occurs at the switch SW2. The networkfailure location detecting apparatus 1 is connected to the SW3.

In the example shown in FIG. 6, the L2 loop occurs at a pair of portnumbers 6 and 8 of the switch SW2. When the L2 loop failure location isdetected, first, the network failure location detecting apparatus 1transmits a plurality of broadcast packets with respective differentdummy source MAC addresses (A, B, C, D, and E) (step S11). Thesebroadcast packets are transferred in loop within the L2 loop.

Each switch SW1, SW2, SW3 is provided with a MAC address table 1 a, 2 a,and 3 a.

Due to the L2 loop, for the plurality of broadcast packets with thedummy source MAC addresses (A, B, C, D, and E), the MAC address learningtable 1 a of the switch SW1 learns that a single port No. 2 is a portinputting the broadcast packets of all the MAC addresses A, B, C, D, andE. In this way, it can be recognized that the L2 loop failure exists inthe input direction of the port No. 2 of the switch SW1.

Similarly, the MAC address learning table 3 a of the switch SW3 learnsthat a single port No. 3 is a port inputting the broadcast packets ofall the MAC addresses A, B, C, D, and E. That is, it can be recognizedthat the L2 loop failure exists in the input direction of the port No. 3of the switch SW3.

On the other hand, in the MAC address learning table 2 a of the switchSW2, each MAC address is learned at a port No. 6 or No. 8. That is, inthe example shown in FIG. 6, the learning table 2 a learns that the portNo. 6 is a port inputting the MAC addresses A, B, and E and that theport No. 8 is a port inputting the MAC addresses C and D. This isbecause in the switch SW2, the broadcast packets flow from the portswith Nos. 6 and 8 in both directions, and the source MAC addresses ofthe input packet and the input ports thereof are learned randomly.

After the transmission of the plurality of broadcast packets with thedifferent source MAC addresses (A, B, C, D, and E), the network failurelocation detecting apparatus 1 acquires a learning direction MIB(dot1dTpFdbPort MIB: Management Information Base), which is statisticalinformation defined in RFC 1156 and RFC 1213, from each switch SW1, SW2,SW3 (step S12).

When the learning direction MIB is acquired, the network failurelocation detecting apparatus 1 determines in the data analyzing unit 12in accordance with the criteria described in FIG. 4 as follows.

(1) The learning direction acquired from the switch SW3 is only onetype, i.e., the port No. 3, for all the source MAC addresses. Therefore,with regard to the switch SW3, the L2 loop exists in the direction ofthe port No. 3.

(2) The learning direction acquired from the switch SW1 is only onetype, i.e., the port No. 2, for all the source MAC addresses. Therefore,with regard to the switch SW2, the L2 loop exists in the direction ofthe port No. 2.

(3) On the other hand, the learning direction acquired from the switchSW1 includes two types. Therefore, a type of the acquired port isdetermined for each switch SW1, SW2, SW3 (step S13). With regard to theSwitches SW1 and SW2, since only one type of the port is included, it isdetermined that the L2 loop exists in the direction of the port (stepS14). On the other hand, with regard to the switch SW2, since two typesof the ports (port Nos. 6 and 8), the L2 loop is generated at the switchSW2 (step S15).

Description will be made of an aspect of the broadcast transmission of aplurality of the packets with different source MAC addresses from thenetwork failure location detecting apparatus 1 for searching the L2 loopfailure location.

FIG. 8 is a sequence chart corresponding to the example of broadcastingthe different source MAC addresses (A, B, C, D, and E) described above.

The statistical information acquiring unit 11 of the network failurelocation detecting apparatus 1 broadcasts packets MAC-A, MAC-B, MAC-C,MAC-D, and MAC-E with the different source MAC addresses (A, B, C, D, E)in large amounts, for example, 1000 packets, for each addresssequentially.

First, when 1000 packets of MAC-A with the source MAC address A arebroadcasted, the packets MAC-A with the source MAC address A flow in tothe L2 loop in the direction for inputting into either or both of theports 6 and 8 at the switch SW2.

When 1000 packets of MAC-B with the source MAC address B arebroadcasted, the packets MAC-B with the source MAC address B flow intothe L2 loop in the direction for inputting into either or both of theports 6 and 8 at the switch SW2 and the preceding MAC-A is replaced bythe MAC-B. The source MAC address A is kept for a certain period in astate of being learned in the direction of either the input port 6 or 8immediately before being replaced by the MAC-B. Similarly, each of thepackets MAC-C, D, and E with the source MAC addresses C, D, E aresubsequently broadcasted, and each source MAC address is kept for acertain period in a state of being learned in the direction of eitherthe port 6 or 8.

On this occasion, in the switches SW3 and SW1, the MAC address islearned at only one port.

The statistical information acquiring unit 11 of the network failurelocation detecting apparatus 1 requests the notification of the learnedMAC address to each of switches SW1, SW2, and SW3 in SNMP (SimpleNetwork Management Protocol) (SNMP Req.). The switches SW1, SW2, and SW3notify the statistical information acquiring unit 11 of the networkfailure location detecting apparatus 1 of the information on thelearning ports of the source MAC address (SNMP Res.)

The statistical information acquiring unit 11 of the network failurelocation detecting apparatus 1 sends the notified information to thedata analyzing unit 12, which determines that the switch SW2 learnsdifferent source MAC addresses at two different ports, and the L2 loopfailure location is certified. The more the types of the different MACaddresses are initially sent out, the higher the probability of beinglearned at two ports and the higher the determination accuracy.

While the packets with different source MAC addresses are sent out inlarge amounts for each address and the packets with each source MACaddress are replaced to acquire the learning state after steadying thelearning state in the procedure shown above, FIG. 9 is a procedure wheneach of a plurality N of packets with different source MAC addresses issent one-by-one sequentially.

In this case, when the packet MAC-A with the source MAC address A isbroadcasted, the packet MAC-A with the source MAC address A flows intothe L2 loop in the direction for inputting into either or both of theports 6 and 8 at the switch SW2 and, subsequently, the packets MAC-Awith the source MAC addresses B, C, D, and e flow similarly.

The notification of the learned MAC address is requested in SNMP (SimpleNetwork Management Protocol) to each of the switches SW1, SW2, and SW3(SNMP Req.). Since the switch SW2 learns in the direction of either theport 6 or 8 at a certain instant, the statistical information acquiringunit 11 of the network failure location detecting apparatus 1 isnotified for the port information that is learned at the timing ofacquiring SNMP.

The statistical information acquiring unit 11 of the network failurelocation detecting apparatus 1 sends the notified information to thedata analyzing unit 12, which determines that the switch SW2 learnsdifferent source MAC addresses at two different ports, and the L2 loopfailure location is certified. The more the types of the different MACaddresses are initially sent out, the higher the probability of beinglearned at two ports and the higher the determination accuracy.

Description will be made of a method of a bypass process for the L2 loopfailure location determined in the above procedure. FIG. 10 is a flow ofa method of a bypass process for the L2 loop failure occurrencelocation.

As described above, it is determined that a loop is created at a pair ofport numbers 6 and 8 of the switch SW2 in the method of the embodimentaccording to the present invention (step S21).

To bypass the L2 loop, a Set command is transmitted to the switch SW2,and the Set command is a command that electrically disconnects theinterface of either the port No. 6 or No. 8 of the switch SW2 (a commandthat makes ifAdminStatus MIB down(2)) (step S22). In this way, the L2loop location of the switch SW2 can be not only detected but alsobypassed.

In the present invention, the addresses of the search target switchesmust be acquired in advance to acquire the statistical information fromthe search target switches.

FIG. 11 is a process flowchart for acquiring the addresses of the searchtarget switches. The network failure location detecting apparatus 1transmits a SNMPGet command that is a predetermined MIB acquisitionrequest to the broadcast addresses of the search target network (S31).The network failure location detecting apparatus 1 receives responsepackets from switches that can respond to the SNMPGet command andextracts the transmission source addresses from the received packets(S32). In this way, the addresses of the search target switches can beacquired. The extracted addresses are set as the addresses of the searchtarget switches (S33).

Since the response packets are unlikely to be received from the switchesin the network (subnet) when the L2 loop is generated, for example, thisaddress acquisition process is preferably performed when it is clearthat the communication in the network is normal (when the L2 loop is notgenerated).

The first three bytes of the acquired switch address (MAC address) arethe OUI (Organizationally Unique Identifier) that identifies the vendorof the switch and the network failure location detecting apparatus 1 mayperform a process considering characteristics of the vendor of thesearch target switch.

FIG. 12 shows a flow of a process considering characteristics of thevendor of the search target switch. The statistical informationacquiring unit 11 of the network failure location detecting apparatus 1preliminarily maintains the first three bytes (OUI: OrganizationallyUnique Identifier) of the MAC addresses of search target apparatuses(switches) and a table that shows relationships with apparatus vendors(step S41).

FIG. 13 is an example of the table that shows a relationship between thefirst three bytes (OUI) of the MAC addresses acquired and stored inadvance and the vendors.

The vendors of the relevant search target apparatuses (switches) areextracted from the first three bytes (OUI) of the MAC addresses. FIG. 14shows a table that correlates the extracted apparatus vendors with thesearch target apparatuses (switches) and the MAC addresses thereof. Aprocess is performed correspondingly to the relevant vendors (e.g.,different communication restoring means depending on the vendors) (stepS42).

FIG. 15 is a flow that shows a procedure of detecting a location linkedto the communication restoring means corresponding to the vendor.

That is, first, the communication restoring means are utilized to ensurethe packet communication with the search target apparatus (switch) (stepS51).

A plurality of broadcast packets with dummy source MAC addresses istransmitted as described above in the embodiment according to thepresent invention and a location causing the L2 loop failure is detectedin the sequence of FIG. 8 or 9 (step S52).

While the illustrative and presently preferred embodiment of the presentinvention has been described in detail herein, it is to be understoodthat the inventive concepts may be otherwise variously embodied andemployed and that the appended claims are intended to be construed toinclude such variations except insofar as limited by the prior art.

1. A method of searching for a L2 loop failure location generated in anyone of a plurality of search target apparatuses disposed in a networkwith a network failure location detecting apparatus, the methodcomprising the steps of: in the network failure location detectingapparatus, broadcasting packets with a plurality of different source MACaddresses; acquiring statistical information that is information of alearning port of the plurality of different source MAC addresses learnedby each of the plurality of search target apparatuses; finding whetherthe number of the learning ports of the plurality of different sourceMAC addresses is one or two from the acquired statistical information;and determining that the L2 loop failure location is the search targetapparatus including two learning ports of the plurality of differentsource MAC addresses.
 2. The network failure location detecting methodof claim 1, wherein the network failure location detecting apparatussends an acquisition request command in the Simple Network ManagementProtocol that is a MIB (Management Information Base) acquisition requestto a plurality of the search target apparatuses disposed in the networkpreliminarily before broadcasting the packets with the plurality ofdifferent source MAC addresses, receives response packets from thesearch target apparatuses capable of responding, and acquires addressesof the search target apparatuses from the received response packets. 3.The network failure location detecting method of claim 1, wherein whenthe search target apparatus includes only one learning port of theplurality of source MAC addresses, it is determined that a networkfailure location exists in the direction of the learning port.
 4. Thenetwork failure location detecting method of claim 1, wherein thenetwork failure location detecting apparatus sends to the search targetapparatus including two learning ports of the plurality of source MACaddresses that is determined as the L2 loop failure location a messagefor blocking an interface of one of the two learning ports to bypass theL2 loop failure.
 5. A network failure location detecting apparatus thatdetects a L2 loop failure location generated in any one of a pluralityof switches disposed in network, the network failure location detectingapparatus comprising: a statistical information acquiring unit thatbroadcasts packets with a plurality of different source MAC addresses,the statistical information acquiring unit acquiring statisticalinformation that is information of a learning port of the plurality ofdifferent source MAC addresses learned by each of the plurality ofsearch target apparatuses; and a data analyzing unit that finds whetherthe number of the learning ports of the plurality of different sourceMAC addresses is one or two from the statistical information acquired bythe statistical information acquiring unit, the data analyzing unitdetermining that the L2 loop failure location is the search targetapparatus including two learning ports of the plurality of differentsource MAC addresses.
 6. The network failure location detectingapparatus of claim 5, wherein the statistical information acquiring unitsends an acquisition request command in the Simple Network ManagementProtocol that is a MIB (Management Information Base) acquisition requestto a plurality of the search target apparatuses disposed in the networkpreliminarily before broadcasting the packets with the plurality ofdifferent source MAC addresses, and wherein the data analyzing unitreceives response packets from the search target apparatuses capable ofresponding and acquires addresses of the search target apparatuses fromthe received response packets.
 7. The network failure location detectingapparatus of claim 5, wherein when the search target apparatus includesonly one learning port of the plurality of source MAC addresses, thedata analyzing unit determines that a network failure location exists inthe direction of the learning port.
 8. The network failure locationdetecting apparatus of claim 5, wherein the statistical informationacquiring unit sends to the search target apparatus including twolearning ports of the plurality of source MAC addresses that isdetermined as the L2 loop failure location a message for blocking aninterface of one of the two learning ports to bypass the L2 loopfailure.
 9. The network failure location detecting apparatus of claim 5,wherein the network failure location detecting apparatus is constitutedby a terminal connected to any one of a plurality of the switchesdisposed in the network.